Scope, and the two roles we play
This policy explains how Progress & Process (Innovative Technologies) LLC ("PPIT," "we," "us"), a Florida limited liability company, handles personal data in connection with Lead Flow Max (the "Service"). It forms part of our Terms of Service and should be read with our Disclaimer.
We handle two different kinds of personal data, and our responsibilities differ for each:
- Data about our customers. When you sign up for and use Lead Flow Max, we are the controller — we decide what to collect and why, and this policy governs it.
- Data about your prospects. When you upload a list, enrich records, or run a campaign, we are your processor — we act on your instructions, and you are the controller responsible for having a lawful basis, giving notice, and honouring rights. Our obligations to you for that data are set out in the Terms of Service and, where you need one, in our data processing addendum.
What we collect about you
Information you give us
- Account details — name, business email address, company name, and any details you add to your profile.
- Billing details — plan, billing contact, and transaction records. Card numbers are collected and stored by Stripe; we never see or store your full card number.
- Content you upload — contact lists, campaign copy, brand assets, and settings.
- Connected accounts — the authorisation tokens that let the Service send from your email or sending provider. We store these encrypted and use them only to operate the Service for you.
- Support and survey responses — messages you send us, and answers to the voluntary beta exit survey.
Information we collect automatically
- Usage data — features used, campaigns created, messages approved or rejected, and timestamps.
- Technical data — IP address, browser and device type, and pages viewed, collected through our hosting provider's analytics.
We do not deliberately collect special-category or sensitive personal data about our customers, and we ask that you do not upload it into the Service.
Lead data and where it comes from
The Service makes business contact records available to customers — typically a name, job title, employer, business email address, business phone number, and publicly reported company signals such as funding events, hiring activity, or product announcements.
This data comes from two places: licensed third-party data and enrichment providers, and our own collection of publicly available web sources and signals. We do not originate the underlying information, and we cannot independently verify it.
If you are an individual whose details appear in Lead Flow Max, Section 13 explains what you can ask us to do.
How we use information
- to provide, operate, secure, and support the Service;
- to authenticate you and manage your account and subscription;
- to process payments and send invoices and renewal notices;
- to respond to your support requests and send service messages about outages, security, and changes to our terms;
- to monitor for abuse, fraud, and violations of our acceptable use rules, and to protect the deliverability reputation of the Service;
- to understand how the Service is used and to improve it, using aggregated and de-identified statistics;
- to send product news and beta updates, where you have opted in — every such message has an unsubscribe link, and opting out does not affect your account;
- to comply with law and to establish or defend legal claims.
We do not use your uploaded contact lists or campaign content to train third-party AI models, and we do not use them to build products for other customers.
Legal bases
Where the GDPR or UK GDPR applies to our processing of your data as a customer, we rely on: contract — to provide the Service you signed up for and to bill for it; legitimate interests — to secure the Service, prevent abuse, understand usage, and communicate about the product, balanced against your rights; consent — for optional marketing messages and non-essential analytics, which you can withdraw at any time; and legal obligation — for tax, accounting, and compliance records.
Who we share information with
We share personal data only with service providers who need it to help us run the Service, under contracts requiring them to protect it and use it only on our instructions. Our current subprocessors:
| Provider | Purpose | Data involved |
|---|---|---|
| Netlify | Website and application hosting, platform analytics | Account details, usage and technical data |
| Stripe | Payment processing and subscription billing | Billing contact, transaction records, card data held by Stripe |
| Anthropic PBC (Claude) | Generating and summarising outreach copy | Campaign inputs and prospect fields used in generation |
| Apollo.io | Sourcing and enriching business contact records | Business contact and company data |
| Your connected email provider | Sending the messages you approve | Message content, recipient addresses |
We may also disclose personal data where required by law, subpoena, or regulator; to establish or defend legal claims; to protect the rights, safety, or property of PPIT, our customers, or the public; and, in a merger, acquisition, or sale of assets, to the acquiring party — in which case we will give notice before your data becomes subject to a different privacy policy.
Cookies and analytics
We use strictly necessary cookies to keep you signed in and to keep the Service secure. These cannot be switched off without breaking the Service.
We use our hosting provider's built-in, privacy-preserving analytics to understand traffic and feature usage. We do not use third-party advertising networks, advertising cookies, cross-site tracking pixels, or social media trackers, and we do not build advertising profiles.
Where required, we ask for your consent before setting non-essential cookies, and we honour Global Privacy Control and similar browser opt-out signals.
We do not sell personal data
We do not sell personal data, and we do not share it for cross-context behavioural or targeted advertising, as those terms are defined under the Florida Digital Bill of Rights and comparable state privacy laws. We do not profile individuals in a way that produces legal or similarly significant effects.
Lead Data is licensed to customers for their own outreach under the restrictions in our Terms of Service; it is not sold, and customers may not resell it.
How long we keep it
- Account data — for as long as your account is open, then deleted or de-identified within 90 days of closure.
- Your uploaded content and campaign data — until you delete it or close your account. Available for export for 30 days after closure, then deleted within 90 days.
- Billing and tax records — as long as required by law, generally seven years.
- Support correspondence — up to two years.
- Beta signup records — held in a private, access-restricted store and deleted within 90 days of the beta ending, unless you convert to a paid account.
Backups follow their own routine cycle and are overwritten in the ordinary course. We may retain data longer where needed to comply with law or to establish or defend legal claims.
How we protect it
We encrypt data in transit using TLS, store it on infrastructure operated by our hosting provider with access limited to authorised personnel, encrypt connected-account tokens at rest, keep beta signup records in a separate access-restricted store, and collect the minimum data needed to run the Service.
What we do not claim. Lead Flow Max does not currently hold SOC 2, ISO 27001, HIPAA, PCI DSS, or any other third-party security certification, and we do not represent that it does. No method of transmission or storage is completely secure and we cannot guarantee absolute security. If your business is subject to a framework requiring a certified processor, do not place regulated data in the Service.
If a breach affects your personal data, we will notify you and any regulator within the timeframes applicable law requires.
Your privacy rights
Depending on where you live, you may have the right to: know and access the personal data we hold about you; correct inaccurate data; delete your data; obtain a portable copy; opt out of sale, targeted advertising, or certain profiling (we do none of these); and withdraw consent where we rely on it.
These rights arise under the Florida Digital Bill of Rights, Fla. Stat. §§ 501.701–501.716, comparable statutes in other US states, and the GDPR and UK GDPR where they apply. We honour them for our customers regardless of whether a particular statute technically covers us, and we will not discriminate against you or degrade your service for exercising them.
Where the GDPR applies you may also object to processing based on legitimate interests and lodge a complaint with your supervisory authority.
How to exercise your rights
Email info@ppitagency.org with the request and the email address on your account. We will acknowledge within two business days and respond substantively within 45 days, extendable once by a further 45 days where the request is complex, and we will tell you if we need the extension.
We may ask for information to verify your identity, and we will use it only for that purpose. An authorised agent may submit a request on your behalf with written proof of authorisation.
Appeals. If we decline your request, our response will explain why and how to appeal. To appeal, reply to that response with the subject line "Privacy Appeal." We will decide within 60 days and explain the outcome in writing. If we deny the appeal you may contact the Florida Attorney General or your own state's regulator.
If you were contacted using Lead Flow Max
If you received an email, call, or text from one of our customers and want it to stop, the fastest route is to reply to the sender directly or use the unsubscribe link in the message — the customer, not PPIT, controls their own list and is the sender of that message.
You may also contact us at info@ppitagency.org to ask us to suppress or delete your details from the Lead Data we make available. We will action that request across our own records, tell you if the data originated with a third-party provider, and identify that provider so you can ask them to remove it at source. Where we act as a processor for a customer, we will forward your request to them and assist their response.
International transfers
We operate from the United States and our providers may process data there. If you are in the EU, UK, or another jurisdiction with transfer restrictions, your data will be transferred to and processed in the United States. Where required, we rely on the European Commission's Standard Contractual Clauses and the UK Addendum, together with appropriate supplementary measures. A copy of the relevant clauses is available on request.
Children
The Service is for business use by adults. It is not directed to anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will delete it.
Changes to this policy
We may update this policy as the Service or the law changes. For material changes we will update the effective date above and notify account holders by email or in-app notice before the change takes effect. Prior versions are available on request.
Contact us
Privacy questions, rights requests, appeals, and data processing addendum requests:
Progress & Process (Innovative Technologies) LLC
info@ppitagency.org
We aim to respond within two business days.
Progress & Process (Innovative Technologies) LLC
7901 4th St N, Ste 300
St. Petersburg, FL 33702
United States